Admission exceptions and retention holds
Scope policy exceptions precisely and distinguish them from protected recovery-data holds.
An admission exception permits a specified action that an ordinary policy would reject. A retention hold prevents removal of selected recovery data. They have different owners, expiry effects, and execution rules.
Request an exception
Under Governance → Exceptions, select the policy, project or resource scope, allowed action, reason, owner, and expiry. Approval is required from the team assigned by organization policy. The requesting principal must still have the ordinary permission for the resource action.
An exception can permit an otherwise disallowed region copy or maintenance window. It cannot make a CPU compatible, remove a storage writer lease, or assert that a failed source was fenced. Those are operational requirements, not admission-policy preferences.
Pin the evaluated revision
An approved exception identifies the policy revision and permitted scope. A request records which exception was evaluated. A later policy revision requires reevaluation; old approvals cannot silently authorize a broader new rule.
Expiry blocks new admission relying on the exception. It does not delete the resources created earlier or cancel already accepted work. The exception view lists resulting resource IDs so their remediation remains explicit.
Apply a retention hold
Open Storage → Backups → Recovery points, select a completed backup or consistency-group recovery point, and choose Holds → Add hold. Record reason, owner, and an optional review date. A review date is a reminder, not an automatic authorization to destroy the data.
A complete group hold retains every required member. Holding only one disk from an unrelated collection does not make that collection an application-consistent recovery point.
Provider locks
A destination-enforced retention lock is evaluated independently of an Infra hold. Removing the Infra hold cannot shorten the provider's required retention. The deletion result identifies both hold and provider conditions when applicable.
Do not use an admission exception to imply that a provider lock has been bypassed. A delete request can be authorized and still fail because the provider refuses physical removal.
Release and audit
Open the recovery point's Holds list, select the hold, and choose Release. Releasing a hold requires explicit permission and a reason. Cleanup re-evaluates ordinary retention afterwards; a point already eligible can then expire. The release review shows that consequence before submission.
Exception approval, use, expiry, hold creation, and hold release are audited. Export the applicable policy revisions alongside the action for compliance review. See Governance API, backup retention, and data residency.